MP.L2-3.8.7 Removable media: requirements and evidence

What MP.L2-3.8.7 removable media control requires of a defense contractor

MP.L2-3.8.7 asks a defense contractor to show that the use of removable media, such as USB drives, CDs and DVDs, is controlled on its system components. The requirement is the Level 2 form of NIST SP 800-171 Rev. 2 requirement 3.8.7, and NIST SP 800-171A assesses it with one assessment objective: the use of removable media on system components is controlled. An assessor will not accept a single control on its own. They will look for a written policy that sets the rules for media use and technical mechanisms that enforce those rules on the systems that handle CUI. The policy language the CMMC Assessment Guide Level 2 describes covers write-once and rewritable media, limits removable media to the smallest number needed, and requires scanning all removable media for viruses. Your policy should say those things in terms your staff can follow, and your configuration should be able to show they happen.

The risk behind the requirement is straightforward. A USB drive can carry CUI out of a controlled environment without leaving a trail, and it can carry malware into a system that has no direct network path to the outside world. The scoring weight makes the stakes concrete. Under the CMMC Scoring Methodology in 32 CFR 170.24, MP.L2-3.8.7 is worth 5 points if NOT MET, and because it is worth more than 1 point, 32 CFR 170.21(a)(2) does not allow it on a plan of action and milestones. It must be MET for your organization to reach Conditional or Final Level 2 status. Treat it as a gate, not a item to schedule for later. Confirm the current status of the assessment timeline and the Phase II suspension with the Department of War before you set internal dates, because those rules shape when an assessment can occur.

Which systems, devices and teams fall under removable media controls

Scoping determines how much of MP.L2-3.8.7 Removable media you must control and who must sign off on it. The decisions below connect the system components that handle CUI, the media that can move data onto them, and the people who own policy, configuration and exceptions.

In-scope system components

Start with every workstation, server, kiosk, test rig and OT device that processes, stores or transmits CUI, because the requirement applies to system components, not only to office laptops. Equipment such as test instruments or engineering workstations often has a USB port and no standard endpoint agent, so it is easy to miss. Record each component in the asset inventory with a clear yes or no on CUI handling, and confirm the boundary with your system security plan.

Media types in play

List every removable media type a user can physically connect: USB flash drives, external hard drives, memory cards, optical discs and any device that presents as storage. Optical drives and card readers are often forgotten on desktops and multifunction systems. Decide which types are blocked, which are allowed for named purposes, and how write-once and rewritable media are handled, since the CMMC Assessment Guide Level 2 recommends a policy that addresses both.

Policy ownership and exceptions

Name one accountable owner for the written removable media policy, usually the CISO or security lead, and a separate approver for exceptions. Exceptions for a specific user, device and business need should be documented with an expiry date and reviewed on a schedule. Without a named owner, assessors struggle to see that the policy is actually enforced, and exception sprawl quietly erodes the control.

Endpoint configuration teams

Identify who configures device control on endpoints, including the internal IT team, platform engineers and any contracted administrator. Those teams must be able to show the restriction mechanism, its settings and the change records that prove it stayed in place. Confirm that the same team cannot silently approve its own exceptions, because assessors will ask who can override a block.

Managed service providers and administrative media

Decide whether a managed service provider that administers your endpoints is inside the assessment boundary. If its engineers use removable media to image, repair or recover your systems, that activity touches CUI systems and must be controlled and recorded like any other use. Review the service agreement for media handling duties and require evidence of the provider's own controls. Confirm the boundary with your assessor before work begins.

Shared and unmanaged devices

Shared kiosks, lab machines and devices that several teams log into often accept personal or unidentified media. Decide whether these systems process CUI at all, and if they do, restrict media use or move them into a controlled configuration. Check that the controls still apply when a user connects a device that was never issued by the organization.

How an assessor tests MP.L2-3.8.7 and which evidence they ask for

This table compares what an assessor does, what evidence they request and where organizations usually fall short for MP.L2-3.8.7. Read each row as one step of the assessment, and check your own environment against the findings column before the assessor arrives.

Assessment element	What the assessor tests or requests	Common findings
Assessment objective	The single SP 800-171A objective: the use of removable media on system components is controlled. The assessor must see that every in-scope system is covered, not only a sample.	Scope is defined as the server room or a few workstations, while removable media is open on laptops and engineering hosts that handle CUI.
System use policy	A written policy that states whether removable media is allowed, which device types are covered, and who approves exceptions. The assessor checks that it is final, approved and current.	A policy exists but is an unsigned draft, or it does not mention CDs, DVDs or write-once media at all.
Media usage restriction procedures	Documented steps for how restrictions are set, changed and checked, including who configures endpoint controls and how exceptions are granted and removed.	Procedures describe a tool the team no longer uses, or they say restrictions are applied without naming the mechanism.
Rules of behavior	Signed or acknowledged user rules that tell staff what they may and may not do with removable media, with records showing users received them.	Rules are generic acceptable-use text with no removable media language, or acknowledgments are missing for contractors and temporary staff.
Technical restriction tests	Direct tests of the mechanisms that block or limit media, such as device control settings, port restrictions or read-only enforcement. The assessor may pick hosts of different types and attempt to use a USB drive.	Restrictions were tested on one host type only, for example Windows laptops, while Linux servers and macOS endpoints were left unchecked.
Write-once and rewritable media	Evidence that the policy addresses both write-once media such as CDs and DVDs and rewritable media, and that each type is handled as the policy states.	Policy covers USB drives but says nothing about optical media, so CD and DVD burners remain available on some systems.
Smallest necessary number of devices	Evidence that removable media is limited to the fewest devices needed for business use, such as an approved device list with a stated business reason for each device.	No device list exists, or the list has grown without review and includes devices no one can justify.
Virus scanning of removable media	Records or configuration showing that all removable media is scanned for malicious code before use, and that scanning is part of the procedure, not an optional step.	Scanning is described in the policy but the scan engine or trigger is not configured on the systems where media is used.
Audit records	Logs or reports showing device connection events, blocked attempts and exception approvals, which let the assessor confirm the restriction works over time.	Logging is off for removable media events, or logs exist but nobody reviews them, so the assessor cannot see enforcement.

How to implement removable media control in six steps

This sequence turns MP.L2-3.8.7 into a documented, tested control: you define where removable media can reach in-scope systems, decide who may use it, enforce that decision technically, and keep evidence that an assessor can verify.

Inventory in-scope components and media paths
Start by listing every system component that stores, processes or transmits CUI, including workstations, servers, kiosks, test equipment and any device with a USB, optical or card port. For each component, record the removable media interfaces it exposes and the people who physically use them. The output is a scoped component list with a media path inventory, reviewed by the system owner and kept with the system security plan. The step is done when every in-scope asset has a named owner and a documented list of ports and drive types.
Write the removable media policy
Draft a written removable media policy that states who may use removable media, for what purpose and on which components. The CMMC Assessment Guide Level 2 recommends that the policy cover write-once and rewritable media, limit removable media to the smallest number needed and require scanning all removable media for viruses, so build those points in directly. Have the security lead and data owners approve the policy, assign a version number and store the approved version with its approval date. The output is an approved policy version that the assessor can match to the configuration you deploy.
Limit devices to the smallest needed number
Using the component list and the policy, decide which removable media devices are actually required. Remove optical drives or USB ports from components that never need them, and narrow allowed devices to a short list of approved, organization-owned media for the roles that need them. Record the reason for each retained interface. The output is a device allowlist and an interface reduction record for each component, showing that use was limited to the smallest number needed rather than left open by default.
Configure technical restrictions
Implement the policy in technology. Typical controls include endpoint device control that blocks or permits USB mass storage, disabling optical drive access where it is not needed, and scanning media on connection with an anti-malware engine. Document each setting as a configuration baseline with the exact policy name, the device classes covered and the enforcement mode. Where open-source tooling is used, confirm with the vendor which device control and scanning functions the chosen version provides before relying on them. The output is a configuration baseline per component class that matches the approved policy.
Define exceptions and owner approval
Some business processes will need media outside the normal allowlist, such as vendor firmware updates or data delivery to an authorized recipient. Define a documented exception process in which the request names the device, the component, the business reason, the duration and the approving data owner. Log every approved exception in an exception register and review it on a schedule you set in your policy. The output is an exception register with owner approvals attached, so that any device that reaches a CUI system can be traced to a decision someone can defend.
Test enforcement and collect final-form evidence
Test the restrictions against the assessment objective, which is that the use of removable media on system components is controlled. Attempt to use an unapproved USB drive and an optical disc on a sample of components from each class, and confirm the block, the scan and the logging behave as the baseline states. Use tooling that reports device connection events and compliance status across a fleet, such as osquery queries, to show results at scale. Store the test records, configuration exports, policy version, exception register and audit records in final form, not drafts, because only final evidence counts toward a MET determination. The output is a signed test record set that a C3PAO or your self-assessment can verify.

Evidence that satisfies removable media control and how to keep it current

Assessors test MP.L2-3.8.7 by reading documents and then checking whether the restrictions work on real systems. The six artifacts below connect the written policy to the configuration, the logs and the exceptions, so each one should be refreshed on a schedule that keeps the picture current between assessments.

Signed removable media policy

The written policy is the first thing an assessor reads, and it must state that removable media use is controlled. It should cover write-once and rewritable media, limit removable media to the smallest number needed, and require scanning all removable media for viruses. Confirm that the policy carries an owner, an approval signature and a version history showing review dates. Only the final approved version counts, so drafts left in the evidence folder can weaken the record.

Media usage restriction procedures

These procedures explain how the policy is put into practice: who approves a device, how a device is registered, how scanning happens and who removes access when a need ends. An assessor samples the procedure against the actual steps staff follow, so the document should match current tooling. Review it at least once per assessment cycle and whenever the endpoint platform changes.

Rules of behavior acknowledgments

Rules of behavior state what users may and may not do with removable media, including prohibited use of unowned devices. Assessors sample signed or electronically recorded acknowledgments from users across roles, including administrators. Keep acknowledgments tied to the current rules version, and collect new ones when the rules change or when a new user joins the system with CUI access.

Device restriction configuration output

This artifact shows the technical restriction is in place on sampled components, such as a block on mass storage classes or an allow list for approved devices. Export the configuration from the endpoint management or security tool and record the host, date and policy version. Osquery can query endpoint state across a fleet, and Fleet policies can show which devices pass or fail a yes or no check, so the output can be produced repeatedly rather than reconstructed for an assessment.

Audit records of media events

Audit records show blocked and permitted removable media events with timestamps, host names and user identities. Assessors look for records that prove the control operated, not only that it was configured. Wazuh Security Configuration Assessment can recheck endpoint settings against policies, and Velociraptor hunts can collect artifacts from many systems at once, including machines that reconnect later. Keep the record set for the period the organization defines and check that logging failures are alerted.

Exception register with approvals

Any device allowed outside the restriction, such as a vendor media for maintenance, needs an entry in the exception register. Each entry should record the requester, business reason, approving official, start and end dates, compensating safeguards and the removal date. Assessors sample exceptions to confirm approval came before use and that expired exceptions were closed. Run a periodic fleet-wide check against the register to find devices that are allowed but not listed.

Why a 5-point removable media gap blocks Conditional and Final Level 2 status

Under the CMMC Scoring Methodology in 32 CFR 170.24, MP.L2-3.8.7 is worth 5 points, and those points come off the maximum score of 110 when the requirement is NOT MET. The bigger problem is the POA&M rule. Because the requirement is worth more than 1 point, 32 CFR 170.21(a)(2) does not allow it to be carried on a plan of action and milestones, so it must be fully MET before an organization can reach Conditional or Final Level 2 status. A removable media gap is not a documentation item you can defer. It is a control that has to work on the day of the assessment.

That changes where effort belongs. A policy that prohibits USB drives on CUI systems will not satisfy the assessment objective on its own, because the single objective in NIST SP 800-171A asks whether the use of removable media on system components is actually controlled. Assessors look for the restriction mechanism and its test results: device control settings, endpoint policies that block or log removable storage, and audit records of attempted use. Before the assessment, run readiness tests on representative components across each enclave, including laptops, workstations, servers and any shared or specialized equipment. Confirm that blocks hold for both rewritable and write-once media, that exceptions are approved and recorded, and that the evidence is in final form rather than a draft policy or an untested configuration.

Timing is also a planning variable. As of the facts available for this page, the Department of War suspended CMMC Phase II on 13 July 2026 and started a 60-day review by a CMMC Reform Task Force, while Phase I self-assessments and DFARS 252.204-7012 obligations remain in place. Confirm the current assessment schedule against the DoW CIO About CMMC page and the rule text in the eCFR before setting internal deadlines, because the eCFR still reflects the original phase schedule.

Which open-source tools can produce removable media evidence

Removable media control is proven by showing both a written policy and the technical state of each endpoint over time. The four tools below can help collect, query and check that state across a fleet, but none of them is a substitute for the policy or for the enforcement decisions your organization owns. Confirm each tool's behavior in your own environment before relying on it for an assessment.

osquery for device state queries

osquery exposes operating system state as SQL tables, and its osqueryd daemon can schedule the same query across an entire fleet of hosts. For MP.L2-3.8.7, the useful question is which tables on each platform expose attached removable storage, USB devices and mounted volumes, and whether those tables return the data you need. Confirm the table names and coverage for each operating system you run, then keep the query schedule and results as recurring evidence. License: Apache-2.0 OR GPL-2.0-only.

Velociraptor for fleet collection

Velociraptor collects forensic artifacts written in VQL from endpoints, and its hunts run one or more artifacts across a group of systems. Offline machines are scheduled to collect when they reconnect, which matters for laptops that leave the network for long periods. Each hunt produces a notebook for analyzing combined results, so the analysis itself can be retained. Confirm with counsel what AGPL-3.0 obligations mean if you modify Velociraptor and offer it to users over a network. License: AGPL-3.0-only.

Wazuh configuration assessment checks

Wazuh Security Configuration Assessment scans monitored endpoints against YAML policies that check files, directories, registry keys and running processes, then recommends remediation. The policies are mostly based on CIS benchmarks and can be extended with custom checks, so you can add a check for the device control settings your written policy requires. Verify that your custom policy actually tests the restriction you claim, because a passing benchmark does not prove a USB restriction exists. License: GPL-2.0-only.

Fleet policies for pass or fail results

Fleet policies ask yes or no questions of devices as osquery queries, and the policies page shows which devices in each fleet pass or fail. A policy such as whether a removable storage restriction is in place gives you a per-device record that a reviewer can read quickly. Fleet reports status, so a failing device still needs a documented response from your team. Confirm which questions your environment can answer reliably before writing them as policies. License: MIT.

What meeting MP.L2-3.8.7 costs in money and effort

This table compares each cost component of meeting MP.L2-3.8.7, who is paid for it, whether it is one-time or recurring, and what moves it up or down. Use it to structure a written quote, since the main takeaway is that the number of in-scope component types and sites drives most of the total.

Cost component	One-time or recurring	What drives it up or down	How to keep it down
Policy drafting and approval	One-time, with periodic review	Number of media types in use, whether write-once and rewritable media are both covered, and how many approvers sign off	Reuse a written removable media policy that already covers write-once and rewritable media, and limit approval to one accountable owner
Endpoint device control or port restriction tooling and licenses	Recurring if commercial, one-time setup if open source	Commercial licenses scale with device count; self-hosted open-source tools remove license spend but not engineering time	Confirm license terms per endpoint or per user before buying, and compare with self-hosted options in the customer environment
Engineering time to configure and test restrictions	One-time, with retesting after changes	Number of distinct component types (Windows, macOS, Linux, servers, kiosks, specialized equipment) and sites with different configurations	Group component types into a small set of baseline configurations and test each group once against a documented test plan
Exception handling effort	Recurring	Frequency of business requests to use removable media, and whether approvals and expiry dates are tracked	Require a written justification, named approver and expiry date for each exception, and review open exceptions on a fixed schedule
Evidence upkeep	Recurring	How often configurations change, how many systems are in scope, and whether logs and restriction records are kept in one place	Export configuration state and policy results on a routine schedule into a single evidence repository
External testing or review of the configuration	One-time for initial review, recurring for retests	Size of the configuration set under review and whether the reviewer must test on live endpoints	Ask for a fixed-scope review of a defined sample of component types rather than an open-ended engagement
Assessor sampling effort	Recurring at each assessment	Number of component types and sites the assessor selects, and how quickly the organization can produce final-form evidence	Prepare final-form evidence for each component type in advance so sampled items can be shown without rework

Who owns removable media control, who can help, and where the assessor stops

Your organization owns MP.L2-3.8.7. That means the written removable media policy, the decisions about which devices and users are exceptions, the settings that restrict media on each system component, and the evidence that the restriction works in practice. The policy should cover write-once and rewritable media, limit removable media to the smallest number needed, and require scanning of all removable media for viruses, as the CMMC Assessment Guide Level 2 describes. Assessors will look for a system use policy, media usage restriction procedures, rules of behavior and audit records, so these documents need owners, approval dates and a review cycle.

Policy ownership: A named role approves the removable media policy and signs off on any change to it.
Exception decisions: Someone accountable approves, records and periodically reviews every exception, such as a user who needs a USB device for a scanner.
Restriction settings: Your team or its platform staff decide how endpoints block or allow media and document the chosen configuration.
Evidence: Your team keeps the policy, configuration records, exception logs and audit records in final form, not drafts.

Before engaging anyone, confirm that your internal owner can answer for each of these items.",

Questions about cost, effort and doing removable media control in-house

How much effort does it take to meet MP.L2-3.8.7 removable media control?

The effort depends on how many systems in scope can read removable media, how many endpoints and servers those systems include, and how much of the control is already enforced by device management. The requirement has one assessment objective, but it is worth 5 points under the scoring methodology, so it cannot sit on a plan of action and milestones and must be fully MET. The work splits into a written removable media policy, technical restrictions on every in-scope system, and evidence that those restrictions operate. Organizations with mature endpoint management usually spend less effort than those configuring removable media rules by hand on a mixed fleet. Ask any quote to state which systems are in scope and which ones are excluded and why.

Can an in-house team meet removable media control without outside help?

Yes, an internal team can meet the control if it has staff who understand the system boundary, endpoint management and the assessment objectives in NIST SP 800-171A. The main gaps are usually a policy that does not cover write-once and rewritable media, no documented exception process, and restrictions that are configured but never tested. An implementation partner can help build the configuration and evidence, but the organization owns the policy, the control and the decisions about exceptions. Only an independent assessor issues an assessment result, so an in-house team should plan how it will show that evidence is final and not a draft.

How long does it take to get removable media restrictions working across the whole fleet?

Timing depends on the number of device types, how many operating system images exist, whether restrictions are pushed centrally, and how many business exceptions must be approved. A pilot group usually surfaces the exceptions, such as scanners, test equipment or hardware that needs a device-specific allow rule, and those take longer than the default policy. Rollout is slower when machines are offline or unmanaged, because the restriction is not in effect until the device checks in. The current CMMC timing is subject to the CMMC rule and the Department of War's current guidance, which has changed in 2026, so confirm with your contracting office which assessment timing applies to your contracts before you set a deadline.

What does the work need from IT and security staff?

The work needs three groups. IT administrators configure device control, manage exceptions and keep images and endpoint agents current. Security staff write the policy, define acceptable exceptions, decide how scanning of removable media is handled and review logs. Compliance or program staff hold the system security plan, collect evidence in final form and track who owns each control. Each group must be named in advance. Ask a partner to state which tasks it expects your staff to perform after the engagement ends, because ongoing exception handling and log review recur long after the first rollout.

Does blocking USB drives alone satisfy the removable media requirement?

No, blocking USB storage alone does not meet the requirement by itself. The assessment looks for a written policy and for mechanisms that restrict or prohibit the use of removable media, and the CMMC Assessment Guide Level 2 expects the policy to address write-once and rewritable media, to limit removable media to the smallest number needed and to require scanning of all removable media for viruses. Blocking USB ports also leaves optical drives, SD cards and other media types uncovered unless you restrict them too. Assessors will test the mechanism, the policy and the audit records together, so a blocked port without a documented policy or evidence of enforcement will not pass.

What should a fixed-scope quote for removable media control include?

A fixed-scope quote should list the systems in scope, the device types to be restricted, the policy documents to be written or revised, the endpoint management or security tooling to be configured, the exception process, the scanning approach for approved removable media, and the evidence to be produced for each assessment objective. It should name the deliverables, the handover to your staff and the exclusions. Ask whether the work includes testing that restrictions operate on representative devices, and whether ongoing support is a separate retainer. DeployOpen agrees scope, deliverables and timelines in writing before work starts and prepares evidence, but it does not issue assessment results. An independent assessor performs the assessment.

How DeployOpen scopes, implements and prepares removable media evidence

DeployOpen works on MP.L2-3.8.7 as a fixed-scope engagement inside your own environment, covering the written removable media policy, the technical restrictions on system components, and the records that show those restrictions operate. We prepare the systems and evidence, while your organization owns the control and an independent assessor makes the determination.

How we scope

Inventory the system components in the CUI boundary where USB drives, optical media and other removable media could be connected.
Agree in writing which removable media types, write-once and rewritable, are covered by the policy and the restrictions.
Confirm the scope document names the owner of the policy, the approvers for exceptions and the systems that need technical enforcement.

How we build

Draft a removable media policy that limits use to the smallest number of devices needed and requires scanning before any media is used.
Configure device restrictions on in-scope endpoints and servers, and test that blocked and permitted media behave as the policy states.
Set up recurring osquery queries or Fleet policies that report which devices pass or fail the removable media rule across the fleet.

How we hand over

Deliver the written policy, procedures, rules of behavior and configuration baselines in final form, ready for the organization to approve.
Provide test records and query results that show the restriction was checked on each in-scope system, with dates and owners.
Walk your team through the evidence set so they can explain it to an assessor, and confirm with your assessor which formats they accept.

How we support

Ongoing support and continuous checks are available as a retainer after handover, including reviewing policy exceptions and drift reports.
Upgrades and changes to endpoint tooling can be scheduled under the same written scope, with updated evidence after each change.
Your organization decides when to request a formal assessment and which assessor performs it. DeployOpen does not issue reports or certifications.

MP.L2-3.8.7 Removable media